Merge from Chromium at DEPS revision r210036

This commit was generated by merge_to_master.py.

Change-Id: I81bec4adc6f28ee4857f3a56aca9657346cbb0c7

11 files changed, 921 insertions, 81 deletions

diff --git a/README.chromium b/README.chromium
index 36b1480..6e49163 100644
--- a/README.chromium
+++ b/README.chromium
@@ -176,6 +176,10 @@ located in patches.chromium/. Currently this consists of:
     Exclude the source files bn_asm.c and rc4_skey.c for x86_64 because
     they are replaced by x86_64-gcc.c and rc4-x86_64.S.
 
+  z_reduce_client_hello_size.patch
+    Advertise support of only the NIST curves P-521, P-384, and P-256,
+    as well as only uncompressed points, to keep ClientHello small.
+
 **************************************************************************
 Adding new Chromium patches:
 
diff --git a/openssl.target.darwin-arm.mk b/openssl.target.darwin-arm.mk
index 7b54d4a..34f31dc 100644
--- a/openssl.target.darwin-arm.mk
+++ b/openssl.target.darwin-arm.mk
@@ -578,7 +578,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
 	-fno-exceptions \
@@ -614,9 +614,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DUSE_LINUX_BREAKPAD' \
@@ -648,10 +646,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -663,10 +660,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -677,9 +673,110 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	-fstack-protector \
+	--param=ssp-buffer-size=4 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-fno-tree-sra \
+	-fuse-ld=gold \
+	-Wno-psabi \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fstack-protector \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DUSE_LINUX_BREAKPAD' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_GF2m' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DGHASH_ASM' \
+	'-DAES_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DSHA512_ASM' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-abi \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -696,6 +793,25 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-Wl,-z,relro \
+	-Wl,-z,now \
+	-fuse-ld=gold \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,--icf=safe \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl.target.darwin-mips.mk b/openssl.target.darwin-mips.mk
index 876b9c8..f4a6779 100644
--- a/openssl.target.darwin-mips.mk
+++ b/openssl.target.darwin-mips.mk
@@ -575,7 +575,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
 	 \
@@ -611,9 +611,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
@@ -641,10 +639,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -656,10 +653,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -670,9 +666,106 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	-fstack-protector \
+	--param=ssp-buffer-size=4 \
+	 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-EL \
+	-mhard-float \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fstack-protector \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DAES_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-uninitialized \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -687,6 +780,23 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-EL \
+	-Wl,--no-keep-memory \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl.target.darwin-x86.mk b/openssl.target.darwin-x86.mk
index 65d9cba..9d03bc3 100644
--- a/openssl.target.darwin-x86.mk
+++ b/openssl.target.darwin-x86.mk
@@ -581,7 +581,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
 	-fno-exceptions \
 	-fno-strict-aliasing \
@@ -619,9 +619,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DUSE_LINUX_BREAKPAD' \
@@ -659,10 +657,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -674,10 +671,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -687,9 +683,119 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	--param=ssp-buffer-size=4 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-m32 \
+	-mmmx \
+	-march=pentium4 \
+	-msse2 \
+	-mfpmath=sse \
+	-fuse-ld=gold \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-fno-stack-protector \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer \
+	-fno-unwind-tables \
+	-fno-asynchronous-unwind-tables
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DUSE_LINUX_BREAKPAD' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_GF2m' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DOPENSSL_BN_ASM_PART_WORDS' \
+	'-DAES_ASM' \
+	'-DGHASH_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DSHA512_ASM' \
+	'-DMD5_ASM' \
+	'-DDES_PTR' \
+	'-DDES_RISC1' \
+	'-DDES_UNROLL' \
+	'-DOPENSSL_CPUID_OBJ' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -704,6 +810,23 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-m32 \
+	-fuse-ld=gold \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl.target.linux-arm.mk b/openssl.target.linux-arm.mk
index 7b54d4a..34f31dc 100644
--- a/openssl.target.linux-arm.mk
+++ b/openssl.target.linux-arm.mk
@@ -578,7 +578,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
 	-fno-exceptions \
@@ -614,9 +614,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DUSE_LINUX_BREAKPAD' \
@@ -648,10 +646,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -663,10 +660,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -677,9 +673,110 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	-fstack-protector \
+	--param=ssp-buffer-size=4 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-fno-tree-sra \
+	-fuse-ld=gold \
+	-Wno-psabi \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fstack-protector \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DUSE_LINUX_BREAKPAD' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_GF2m' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DGHASH_ASM' \
+	'-DAES_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DSHA512_ASM' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-abi \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -696,6 +793,25 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-Wl,-z,relro \
+	-Wl,-z,now \
+	-fuse-ld=gold \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,--icf=safe \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl.target.linux-mips.mk b/openssl.target.linux-mips.mk
index 876b9c8..f4a6779 100644
--- a/openssl.target.linux-mips.mk
+++ b/openssl.target.linux-mips.mk
@@ -575,7 +575,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	-fstack-protector \
 	--param=ssp-buffer-size=4 \
 	 \
@@ -611,9 +611,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DNO_TCMALLOC' \
@@ -641,10 +639,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -656,10 +653,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -670,9 +666,106 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	-fstack-protector \
+	--param=ssp-buffer-size=4 \
+	 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-EL \
+	-mhard-float \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fstack-protector \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DAES_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-uninitialized \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -687,6 +780,23 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-EL \
+	-Wl,--no-keep-memory \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl.target.linux-x86.mk b/openssl.target.linux-x86.mk
index 65d9cba..9d03bc3 100644
--- a/openssl.target.linux-x86.mk
+++ b/openssl.target.linux-x86.mk
@@ -581,7 +581,7 @@ LOCAL_SRC_FILES := \
 
 
 # Flags passed to both C and C++ files.
-MY_CFLAGS := \
+MY_CFLAGS_Debug := \
 	--param=ssp-buffer-size=4 \
 	-fno-exceptions \
 	-fno-strict-aliasing \
@@ -619,9 +619,7 @@ MY_CFLAGS := \
 	-fdata-sections \
 	-ffunction-sections
 
-MY_CFLAGS_C :=
-
-MY_DEFS := \
+MY_DEFS_Debug := \
 	'-DANGLE_DX11' \
 	'-D_FILE_OFFSET_BITS=64' \
 	'-DUSE_LINUX_BREAKPAD' \
@@ -659,10 +657,9 @@ MY_DEFS := \
 	'-DWTF_USE_DYNAMIC_ANNOTATIONS=1' \
 	'-D_DEBUG'
 
-LOCAL_CFLAGS := $(MY_CFLAGS_C) $(MY_CFLAGS) $(MY_DEFS)
 
 # Include paths placed before CFLAGS/CPPFLAGS
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES_Debug := \
 	$(LOCAL_PATH)/third_party/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl \
 	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
@@ -674,10 +671,9 @@ LOCAL_C_INCLUDES := \
 	$(PWD)/bionic \
 	$(PWD)/external/stlport/stlport
 
-LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES)
 
 # Flags passed to only C++ (and not C) files.
-LOCAL_CPPFLAGS := \
+LOCAL_CPPFLAGS_Debug := \
 	-fno-rtti \
 	-fno-threadsafe-statics \
 	-fvisibility-inlines-hidden \
@@ -687,9 +683,119 @@ LOCAL_CPPFLAGS := \
 	-Wno-sign-promo \
 	-Wno-non-virtual-dtor
 
+
+# Flags passed to both C and C++ files.
+MY_CFLAGS_Release := \
+	--param=ssp-buffer-size=4 \
+	-fno-exceptions \
+	-fno-strict-aliasing \
+	-Wno-unused-parameter \
+	-Wno-missing-field-initializers \
+	-fvisibility=hidden \
+	-pipe \
+	-fPIC \
+	-w \
+	-Wno-format \
+	-m32 \
+	-mmmx \
+	-march=pentium4 \
+	-msse2 \
+	-mfpmath=sse \
+	-fuse-ld=gold \
+	-ffunction-sections \
+	-funwind-tables \
+	-g \
+	-fno-short-enums \
+	-finline-limit=64 \
+	-Wa,--noexecstack \
+	-U_FORTIFY_SOURCE \
+	-Wno-extra \
+	-Wno-ignored-qualifiers \
+	-Wno-type-limits \
+	-Wno-address \
+	-Wno-format-security \
+	-Wno-return-type \
+	-Wno-sequence-point \
+	-fno-stack-protector \
+	-Os \
+	-fno-ident \
+	-fdata-sections \
+	-ffunction-sections \
+	-fomit-frame-pointer \
+	-fno-unwind-tables \
+	-fno-asynchronous-unwind-tables
+
+MY_DEFS_Release := \
+	'-DANGLE_DX11' \
+	'-D_FILE_OFFSET_BITS=64' \
+	'-DUSE_LINUX_BREAKPAD' \
+	'-DNO_TCMALLOC' \
+	'-DDISABLE_NACL' \
+	'-DCHROMIUM_BUILD' \
+	'-DUSE_LIBJPEG_TURBO=1' \
+	'-DUSE_PROPRIETARY_CODECS' \
+	'-DENABLE_GPU=1' \
+	'-DUSE_OPENSSL=1' \
+	'-DENABLE_EGLIMAGE=1' \
+	'-DENABLE_LANGUAGE_DETECTION=1' \
+	'-DNO_WINDOWS_BRAINDEATH' \
+	'-DPURIFY' \
+	'-DMONOLITH' \
+	'-DOPENSSL_BN_ASM_GF2m' \
+	'-DOPENSSL_BN_ASM_MONT' \
+	'-DOPENSSL_BN_ASM_PART_WORDS' \
+	'-DAES_ASM' \
+	'-DGHASH_ASM' \
+	'-DSHA1_ASM' \
+	'-DSHA256_ASM' \
+	'-DSHA512_ASM' \
+	'-DMD5_ASM' \
+	'-DDES_PTR' \
+	'-DDES_RISC1' \
+	'-DDES_UNROLL' \
+	'-DOPENSSL_CPUID_OBJ' \
+	'-DANDROID' \
+	'-D__GNU_SOURCE=1' \
+	'-DUSE_STLPORT=1' \
+	'-D_STLP_USE_PTR_SPECIALIZATIONS=1' \
+	'-DCHROME_BUILD_ID=""' \
+	'-DNDEBUG' \
+	'-DNVALGRIND' \
+	'-DDYNAMIC_ANNOTATIONS_ENABLED=0'
+
+
+# Include paths placed before CFLAGS/CPPFLAGS
+LOCAL_C_INCLUDES_Release := \
+	$(LOCAL_PATH)/third_party/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/asn1 \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/evp \
+	$(LOCAL_PATH)/third_party/openssl/openssl/crypto/modes \
+	$(LOCAL_PATH)/third_party/openssl/openssl/include \
+	$(PWD)/frameworks/wilhelm/include \
+	$(PWD)/bionic \
+	$(PWD)/external/stlport/stlport
+
+
+# Flags passed to only C++ (and not C) files.
+LOCAL_CPPFLAGS_Release := \
+	-fno-rtti \
+	-fno-threadsafe-statics \
+	-fvisibility-inlines-hidden \
+	-Wno-deprecated \
+	-Wno-error=c++0x-compat \
+	-Wno-non-virtual-dtor \
+	-Wno-sign-promo \
+	-Wno-non-virtual-dtor
+
+
+LOCAL_CFLAGS := $(MY_CFLAGS_$(GYP_CONFIGURATION)) $(MY_DEFS_$(GYP_CONFIGURATION))
+LOCAL_C_INCLUDES := $(GYP_COPIED_SOURCE_ORIGIN_DIRS) $(LOCAL_C_INCLUDES_$(GYP_CONFIGURATION))
+LOCAL_CPPFLAGS := $(LOCAL_CPPFLAGS_$(GYP_CONFIGURATION))
 ### Rules for final target.
 
-LOCAL_LDFLAGS := \
+LOCAL_LDFLAGS_Debug := \
 	-Wl,-z,now \
 	-Wl,-z,relro \
 	-Wl,-z,noexecstack \
@@ -704,6 +810,23 @@ LOCAL_LDFLAGS := \
 	-Wl,--as-needed
 
 
+LOCAL_LDFLAGS_Release := \
+	-Wl,-z,now \
+	-Wl,-z,relro \
+	-Wl,-z,noexecstack \
+	-fPIC \
+	-m32 \
+	-fuse-ld=gold \
+	-nostdlib \
+	-Wl,--no-undefined \
+	-Wl,--exclude-libs=ALL \
+	-Wl,-O1 \
+	-Wl,--as-needed \
+	-Wl,--gc-sections
+
+
+LOCAL_LDFLAGS := $(LOCAL_LDFLAGS_$(GYP_CONFIGURATION))
+
 LOCAL_STATIC_LIBRARIES :=
 
 # Enable grouping to fix circular references
diff --git a/openssl/openssl.config b/openssl/openssl.config
index 78dac05..7519558 100644
--- a/openssl/openssl.config
+++ b/openssl/openssl.config
@@ -995,6 +995,7 @@ channelid.patch \
 eng_dyn_dirs.patch \
 fix_clang_build.patch \
 x509_hash_name_algorithm_change.patch \
+reduce_client_hello_size.patch \
 "
 
 OPENSSL_PATCHES_progs_SOURCES="\
@@ -1054,3 +1055,7 @@ crypto/x509v3/v3_utl.c \
 OPENSSL_PATCHES_x509_hash_name_algorithm_change_SOURCES="\
 crypto/x509/by_dir.c \
 "
+
+OPENSSL_PATCHES_reduce_client_hello_size_SOURCES="\
+ssl/t1_lib.c \
+"
diff --git a/openssl/patches/reduce_client_hello_size.patch b/openssl/patches/reduce_client_hello_size.patch
new file mode 100644
index 0000000..b4e3c23
--- /dev/null
+++ b/openssl/patches/reduce_client_hello_size.patch
@@ -0,0 +1,64 @@
+diff -burN android-openssl.orig/ssl/t1_lib.c android-openssl/ssl/t1_lib.c
+--- android-openssl.orig/ssl/t1_lib.c	2013-06-21 14:24:45.338681810 -0700
++++ android-openssl/ssl/t1_lib.c	2013-06-21 14:34:07.977205221 -0700
+@@ -202,33 +202,14 @@
+ 		NID_secp521r1  /* secp521r1 (25) */	
+ 	};
+ 
++/* We support only the elliptic curves that are also supported by NSS
++ * to improve compatibility with sites that don't accept large ClientHellos.
++ */
+ static int pref_list[] =
+ 	{
+-		NID_sect571r1, /* sect571r1 (14) */ 
+-		NID_sect571k1, /* sect571k1 (13) */ 
+ 		NID_secp521r1, /* secp521r1 (25) */	
+-		NID_sect409k1, /* sect409k1 (11) */ 
+-		NID_sect409r1, /* sect409r1 (12) */
+ 		NID_secp384r1, /* secp384r1 (24) */
+-		NID_sect283k1, /* sect283k1 (9) */
+-		NID_sect283r1, /* sect283r1 (10) */ 
+-		NID_secp256k1, /* secp256k1 (22) */ 
+ 		NID_X9_62_prime256v1, /* secp256r1 (23) */ 
+-		NID_sect239k1, /* sect239k1 (8) */ 
+-		NID_sect233k1, /* sect233k1 (6) */
+-		NID_sect233r1, /* sect233r1 (7) */ 
+-		NID_secp224k1, /* secp224k1 (20) */ 
+-		NID_secp224r1, /* secp224r1 (21) */
+-		NID_sect193r1, /* sect193r1 (4) */ 
+-		NID_sect193r2, /* sect193r2 (5) */ 
+-		NID_secp192k1, /* secp192k1 (18) */
+-		NID_X9_62_prime192v1, /* secp192r1 (19) */ 
+-		NID_sect163k1, /* sect163k1 (1) */
+-		NID_sect163r1, /* sect163r1 (2) */
+-		NID_sect163r2, /* sect163r2 (3) */
+-		NID_secp160k1, /* secp160k1 (15) */
+-		NID_secp160r1, /* secp160r1 (16) */ 
+-		NID_secp160r2, /* secp160r2 (17) */ 
+ 	};
+ 
+ int tls1_ec_curve_id2nid(int curve_id)
+@@ -1703,17 +1684,18 @@
+ 	if (using_ecc)
+ 		{
+ 		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
+-		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
++		/* To save an additional 2 bytes in the ClientHello, we only advertise support
++		 * for the only EC Point Format that NSS supports (instead of all 3).
++		 */
++		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(1)) == NULL)
+ 			{
+ 			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
+ 			return -1;
+ 			}
+-		s->tlsext_ecpointformatlist_length = 3;
++		s->tlsext_ecpointformatlist_length = 1;
+ 		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
+-		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
+-		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
+ 
+-		/* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
++		/* we only advertise support for elliptic curves in NSA Suite B */
+ 		if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
+ 		s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
+ 		if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
diff --git a/openssl/ssl/t1_lib.c b/openssl/ssl/t1_lib.c
index 28d45b3..f447f22 100644
--- a/openssl/ssl/t1_lib.c
+++ b/openssl/ssl/t1_lib.c
@@ -202,33 +202,14 @@ static int nid_list[] =
 		NID_secp521r1  /* secp521r1 (25) */	
 	};
 
+/* We support only the elliptic curves that are also supported by NSS
+ * to improve compatibility with sites that don't accept large ClientHellos.
+ */
 static int pref_list[] =
 	{
-		NID_sect571r1, /* sect571r1 (14) */ 
-		NID_sect571k1, /* sect571k1 (13) */ 
 		NID_secp521r1, /* secp521r1 (25) */	
-		NID_sect409k1, /* sect409k1 (11) */ 
-		NID_sect409r1, /* sect409r1 (12) */
 		NID_secp384r1, /* secp384r1 (24) */
-		NID_sect283k1, /* sect283k1 (9) */
-		NID_sect283r1, /* sect283r1 (10) */ 
-		NID_secp256k1, /* secp256k1 (22) */ 
 		NID_X9_62_prime256v1, /* secp256r1 (23) */ 
-		NID_sect239k1, /* sect239k1 (8) */ 
-		NID_sect233k1, /* sect233k1 (6) */
-		NID_sect233r1, /* sect233r1 (7) */ 
-		NID_secp224k1, /* secp224k1 (20) */ 
-		NID_secp224r1, /* secp224r1 (21) */
-		NID_sect193r1, /* sect193r1 (4) */ 
-		NID_sect193r2, /* sect193r2 (5) */ 
-		NID_secp192k1, /* secp192k1 (18) */
-		NID_X9_62_prime192v1, /* secp192r1 (19) */ 
-		NID_sect163k1, /* sect163k1 (1) */
-		NID_sect163r1, /* sect163r1 (2) */
-		NID_sect163r2, /* sect163r2 (3) */
-		NID_secp160k1, /* secp160k1 (15) */
-		NID_secp160r1, /* secp160r1 (16) */ 
-		NID_secp160r2, /* secp160r2 (17) */ 
 	};
 
 int tls1_ec_curve_id2nid(int curve_id)
@@ -1703,17 +1684,18 @@ int ssl_prepare_clienthello_tlsext(SSL *s)
 	if (using_ecc)
 		{
 		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
-		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
+		/* To save an additional 2 bytes in the ClientHello, we only advertise support
+		 * for the only EC Point Format that NSS supports (instead of all 3).
+		 */
+		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(1)) == NULL)
 			{
 			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
 			return -1;
 			}
-		s->tlsext_ecpointformatlist_length = 3;
+		s->tlsext_ecpointformatlist_length = 1;
 		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
-		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
-		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 
-		/* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
+		/* we only advertise support for elliptic curves in NSA Suite B */
 		if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
 		s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
 		if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
diff --git a/patches.chromium/z_reduce_client_hello_size.patch b/patches.chromium/z_reduce_client_hello_size.patch
new file mode 100644
index 0000000..1bac5cc
--- /dev/null
+++ b/patches.chromium/z_reduce_client_hello_size.patch
@@ -0,0 +1,87 @@
+diff -burN android-openssl.orig/openssl.config android-openssl/openssl.config
+--- android-openssl.orig/openssl.config	2013-06-21 14:24:36.298545589 -0700
++++ android-openssl/openssl.config	2013-06-21 14:30:36.253997113 -0700
+@@ -995,6 +995,7 @@
+ eng_dyn_dirs.patch \
+ fix_clang_build.patch \
+ x509_hash_name_algorithm_change.patch \
++reduce_client_hello_size.patch \
+ "
+ 
+ OPENSSL_PATCHES_progs_SOURCES="\
+@@ -1054,3 +1055,7 @@
+ OPENSSL_PATCHES_x509_hash_name_algorithm_change_SOURCES="\
+ crypto/x509/by_dir.c \
+ "
++
++OPENSSL_PATCHES_reduce_client_hello_size_SOURCES="\
++ssl/t1_lib.c \
++"
+diff -burN android-openssl.orig/patches/reduce_client_hello_size.patch android-openssl/patches/reduce_client_hello_size.patch
+--- android-openssl.orig/patches/reduce_client_hello_size.patch	1969-12-31 16:00:00.000000000 -0800
++++ android-openssl/patches/reduce_client_hello_size.patch	2013-06-21 14:35:14.508212895 -0700
+@@ -0,0 +1,64 @@
++diff -burN android-openssl.orig/ssl/t1_lib.c android-openssl/ssl/t1_lib.c
++--- android-openssl.orig/ssl/t1_lib.c	2013-06-21 14:24:45.338681810 -0700
+++++ android-openssl/ssl/t1_lib.c	2013-06-21 14:34:07.977205221 -0700
++@@ -202,33 +202,14 @@
++ 		NID_secp521r1  /* secp521r1 (25) */	
++ 	};
++ 
+++/* We support only the elliptic curves that are also supported by NSS
+++ * to improve compatibility with sites that don't accept large ClientHellos.
+++ */
++ static int pref_list[] =
++ 	{
++-		NID_sect571r1, /* sect571r1 (14) */ 
++-		NID_sect571k1, /* sect571k1 (13) */ 
++ 		NID_secp521r1, /* secp521r1 (25) */	
++-		NID_sect409k1, /* sect409k1 (11) */ 
++-		NID_sect409r1, /* sect409r1 (12) */
++ 		NID_secp384r1, /* secp384r1 (24) */
++-		NID_sect283k1, /* sect283k1 (9) */
++-		NID_sect283r1, /* sect283r1 (10) */ 
++-		NID_secp256k1, /* secp256k1 (22) */ 
++ 		NID_X9_62_prime256v1, /* secp256r1 (23) */ 
++-		NID_sect239k1, /* sect239k1 (8) */ 
++-		NID_sect233k1, /* sect233k1 (6) */
++-		NID_sect233r1, /* sect233r1 (7) */ 
++-		NID_secp224k1, /* secp224k1 (20) */ 
++-		NID_secp224r1, /* secp224r1 (21) */
++-		NID_sect193r1, /* sect193r1 (4) */ 
++-		NID_sect193r2, /* sect193r2 (5) */ 
++-		NID_secp192k1, /* secp192k1 (18) */
++-		NID_X9_62_prime192v1, /* secp192r1 (19) */ 
++-		NID_sect163k1, /* sect163k1 (1) */
++-		NID_sect163r1, /* sect163r1 (2) */
++-		NID_sect163r2, /* sect163r2 (3) */
++-		NID_secp160k1, /* secp160k1 (15) */
++-		NID_secp160r1, /* secp160r1 (16) */ 
++-		NID_secp160r2, /* secp160r2 (17) */ 
++ 	};
++ 
++ int tls1_ec_curve_id2nid(int curve_id)
++@@ -1703,17 +1684,18 @@
++ 	if (using_ecc)
++ 		{
++ 		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
++-		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
+++		/* To save an additional 2 bytes in the ClientHello, we only advertise support
+++		 * for the only EC Point Format that NSS supports (instead of all 3).
+++		 */
+++		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(1)) == NULL)
++ 			{
++ 			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
++ 			return -1;
++ 			}
++-		s->tlsext_ecpointformatlist_length = 3;
+++		s->tlsext_ecpointformatlist_length = 1;
++ 		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
++-		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
++-		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
++ 
++-		/* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
+++		/* we only advertise support for elliptic curves in NSA Suite B */
++ 		if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
++ 		s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
++ 		if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)